6 ms·

IPv4 address exhaustion and the end of the open net

61 points by corbet 16y ago

bryanlarsen 16y ago
Reminder: this is a link to LWN, one of the few places on the internet that I know of where the comments are consistently more knowledgeable and more insightful than hacker news, in my opinion. So read the original article, but more importantly, read the comments.
- bryanlarsen 16y ago
  But they really need a way to vote up comments, because there are a lot of them, it'd be nice to have the gems float to the top...
  - ominous_prime 16y ago
    I agree. After living on proggit, then HN for so long, I really miss not having a way to vote on the comments. Even more than getting the good comments to the top, I would like to get the off-topic, pointless, or factually incorrect threads to the bottom. often, an early comment in isn't directly relevant, but may spawn a long discussion.
- radioactive21 16y ago
  Wow this is awesome, the comments were very informative, I ended up reading all of them. I kept thinking, when will I see a lame stupid comment, and as far as I remember there really weren't any.
HyprMusic 16y ago
Can't we just claim back some of Egypt's IP addresses?
JoachimSchipper 16y ago
> [An ISP-level] NAT router will have to handle large numbers of connections simultaneously, to the point that it will run out of port numbers. Ports numbers are only 16 bits, after all. That's only if you track NAT by <my_port> only; just use <my_addr>,<my_port>,<remote_host> instead (Windows tracks ports only, but everything else seems to get it right). Of course, big routers are still expensive, and the other issues are quite real.
- bryanlarsen 16y ago
  That works for already established connections, but how does that work for new connections from unknown remote hosts?
  - bensummers 16y ago
    You create the mapping when the connection is opened. Remember you only have to deal with outgoing connections from hosts behind the NAT device.
  - JoachimSchipper 16y ago
    You could imagine something uPnP-like (or maybe just uPnP - I'm not too sure about how that protocol works) to dynamically create <remote_addr> -> <my_box> mappings; otherwise, just drop the packets. (Software already works behind bad NAT routers - dealing with this particular atrocity is nothing new.)
- simcop2387 16y ago
  And what do you do when two people want to go to youtube at the same time? since the packets coming back could be to the same port from the same remote host you can't say which is which. You might be able to get around this by using the tcp window field but the more you have to examine the packets to do this the more expensive it becomes to route packets. And even then you aren't sure that you won't have the same things happening with the same window parameter. there's all kinds of complicated multiplexing and routing you can do but eventually it just becomes cheaper to switch to ipv6 and not have to deal with these issues at all.
  - JoachimSchipper 16y ago
    It's not like a single youtube IP is going to stream data to more than 2^16 clients - the whole thing is heavily clustered and distributed, after all. Yes, this may become an issue in the future.
- joeyh 16y ago
  To quote the first comment from LWN: " I've seen situations where the same (src ip, src port, dest ip, dest port) are reused within 3 seconds of the FIN from the first connection coming past. A large corporation NATted behind a single IP."
martinkallstrom 16y ago
We engineers really blew it with Y2K. Now when real shit goes down, people think we cry wolf.
simias 16y ago
But we're going to have to live with the consequences, which include running dual stacks for a transition period that, he thinks, could easily take ten years. I have a hard time imagining that happen. What I think would happen in such a situation is that some $newcoolsite will for some reason or an other run only on IPv6 and all the cool kids in the block will make sure to upgrade their equipment to be able to use it or even pressuring their ISPs if they're not IPv6-ready. After all, even windows XP supports IPv6 with the right service pack, if I recall correctly. I think all the equipment I own is IPv6-ready, if not yet IPv6-enabled. As for the domestic routers that only support IPv4, aren't most of those only there to do NAT in the first place? 10 years is a hell of a long time in internet time.
- yread 16y ago
  Yes, but what about IE6? It is going to be 10 years old in August... There will still be people who just won't care about %newcoolsite%
- btilly 16y ago
  If $newcoolsite only runs on IPV6, nobody will use it and it will quickly become $deadwannabesite. This is a very big chicken and egg problem.
  - Dylanlacey 16y ago
    This is a problem that Mr Incumbent Benevolent Internet God could solve, IF Google wanted too. "Dear The Internet. We are switching to IPv6. We STRONGLY suggest you do the same. If you don't, your customers WILL cry and WILL migrate to the other carriers, because they're not going to give us up. Love and Packets, Google. PS: We know everything your CEO has ever searched for. Yes. Even "THAT"."
Perceval 16y ago
This reminds me of how geopoliticians wrote about the closure of uncolonized spaces around the turn of the last century. The Turner thesis looked at the effect of the open frontier on America and speculated in the political and economic consequences of the exhaustion of 'free' land. Halford Mackinder noted the closure of the final pieces of colonizable land and argued that conflicts between major powers would increase now that the safety valve of expansion was lost. Now that 'cyberspace' is facing the closure of free 'space' we are seeing similar arguments being put forward about the economic changes that we will face in the new political-economy of a closed Internet. http://en.wikipedia.org/wiki/Frontier_Thesis http://en.wikipedia.org/wiki/Frontier_Thesis
dualboot 16y ago
Easy solution : Allow the pirates to run wild on IPv6. Everyone else will follow.
michaelbuckbee 16y ago
I'm a developer, tech support for my extended family, and admin for a bunch of web stack boxes. Is there a guide on what I (or everyone else) should be doing to mitigate this? Or are the steps that need to be / can be taken immediately only at the ISP level? From the comments on the article it seemed like there was even still some disagreement on quite what to do.

61 points by corbet 16y ago

Reminder: this is a link to LWN, one of the few places on the internet that I know of where the comments are consistently more knowledgeable and more insightful than hacker news, in my opinion. So read the original article, but more importantly, read the comments.

bryanlarsen 16y ago
But they really need a way to vote up comments, because there are a lot of them, it'd be nice to have the gems float to the top...
- ominous_prime 16y ago
  I agree. After living on proggit, then HN for so long, I really miss not having a way to vote on the comments. Even more than getting the good comments to the top, I would like to get the off-topic, pointless, or factually incorrect threads to the bottom. often, an early comment in isn't directly relevant, but may spawn a long discussion.
radioactive21 16y ago
Wow this is awesome, the comments were very informative, I ended up reading all of them. I kept thinking, when will I see a lame stupid comment, and as far as I remember there really weren't any.

HyprMusic 16y ago

Can't we just claim back some of Egypt's IP addresses?

JoachimSchipper 16y ago

> [An ISP-level] NAT router will have to handle large numbers of connections simultaneously, to the point that it will run out of port numbers. Ports numbers are only 16 bits, after all. That's only if you track NAT by <my_port> only; just use <my_addr>,<my_port>,<remote_host> instead (Windows tracks ports only, but everything else seems to get it right). Of course, big routers are still expensive, and the other issues are quite real.

bryanlarsen 16y ago
That works for already established connections, but how does that work for new connections from unknown remote hosts?
- bensummers 16y ago
  You create the mapping when the connection is opened. Remember you only have to deal with outgoing connections from hosts behind the NAT device.
- JoachimSchipper 16y ago
  You could imagine something uPnP-like (or maybe just uPnP - I'm not too sure about how that protocol works) to dynamically create <remote_addr> -> <my_box> mappings; otherwise, just drop the packets. (Software already works behind bad NAT routers - dealing with this particular atrocity is nothing new.)
simcop2387 16y ago
And what do you do when two people want to go to youtube at the same time? since the packets coming back could be to the same port from the same remote host you can't say which is which. You might be able to get around this by using the tcp window field but the more you have to examine the packets to do this the more expensive it becomes to route packets. And even then you aren't sure that you won't have the same things happening with the same window parameter. there's all kinds of complicated multiplexing and routing you can do but eventually it just becomes cheaper to switch to ipv6 and not have to deal with these issues at all.
- JoachimSchipper 16y ago
  It's not like a single youtube IP is going to stream data to more than 2^16 clients - the whole thing is heavily clustered and distributed, after all. Yes, this may become an issue in the future.
joeyh 16y ago
To quote the first comment from LWN: " I've seen situations where the same (src ip, src port, dest ip, dest port) are reused within 3 seconds of the FIN from the first connection coming past. A large corporation NATted behind a single IP."

martinkallstrom 16y ago

We engineers really blew it with Y2K. Now when real shit goes down, people think we cry wolf.

simias 16y ago

But we're going to have to live with the consequences, which include running dual stacks for a transition period that, he thinks, could easily take ten years. I have a hard time imagining that happen. What I think would happen in such a situation is that some $newcoolsite will for some reason or an other run only on IPv6 and all the cool kids in the block will make sure to upgrade their equipment to be able to use it or even pressuring their ISPs if they're not IPv6-ready. After all, even windows XP supports IPv6 with the right service pack, if I recall correctly. I think all the equipment I own is IPv6-ready, if not yet IPv6-enabled. As for the domestic routers that only support IPv4, aren't most of those only there to do NAT in the first place? 10 years is a hell of a long time in internet time.

yread 16y ago
Yes, but what about IE6? It is going to be 10 years old in August... There will still be people who just won't care about %newcoolsite%
btilly 16y ago
If $newcoolsite only runs on IPV6, nobody will use it and it will quickly become $deadwannabesite. This is a very big chicken and egg problem.
- Dylanlacey 16y ago
  This is a problem that Mr Incumbent Benevolent Internet God could solve, IF Google wanted too. "Dear The Internet. We are switching to IPv6. We STRONGLY suggest you do the same. If you don't, your customers WILL cry and WILL migrate to the other carriers, because they're not going to give us up. Love and Packets, Google. PS: We know everything your CEO has ever searched for. Yes. Even "THAT"."

Perceval 16y ago

This reminds me of how geopoliticians wrote about the closure of uncolonized spaces around the turn of the last century. The Turner thesis looked at the effect of the open frontier on America and speculated in the political and economic consequences of the exhaustion of 'free' land. Halford Mackinder noted the closure of the final pieces of colonizable land and argued that conflicts between major powers would increase now that the safety valve of expansion was lost. Now that 'cyberspace' is facing the closure of free 'space' we are seeing similar arguments being put forward about the economic changes that we will face in the new political-economy of a closed Internet. http://en.wikipedia.org/wiki/Frontier_Thesis http://en.wikipedia.org/wiki/Frontier_Thesis

dualboot 16y ago

Easy solution : Allow the pirates to run wild on IPv6. Everyone else will follow.

michaelbuckbee 16y ago

I'm a developer, tech support for my extended family, and admin for a bunch of web stack boxes. Is there a guide on what I (or everyone else) should be doing to mitigate this? Or are the steps that need to be / can be taken immediately only at the ISP level? From the comments on the article it seemed like there was even still some disagreement on quite what to do.